Privacy Policy

The data controller for your personal data is:

We collect only the data necessary to provide the service:

• Email address (to create and manage your account).
• Domains you enter for search (necessary to perform searches in our sources).
• Payment data processed by our payment provider (we do not store card data; the provider acts as a data processor).
• IP address and technical navigation data (access logs, necessary for service security).
• Payment client ID linked to your account, to manage payment history.

We do not collect special category data (health, ideology, biometrics, etc.).

We process your data for the following purposes:

We retain your data while you maintain an active account with pwndr. After account deletion:

• Account and domain data is deleted within a maximum of 30 days.
• Payment records are retained for 5 years due to tax and accounting obligations (Art. 30 VAT Law).
• Access logs are retained for 12 months due to security requirements.

We share data only with providers strictly necessary to provide the service, all with adequate data protection guarantees:

• Database infrastructure and authentication provider — with EU standard contractual clauses.
• Payment processing provider — adherent to the EU-US DPF.
• Hosting and deployment provider — with EU standard contractual clauses.
• Threat intelligence data provider — domain processing only.

We do not sell or transfer your data to third parties for commercial or advertising purposes.

As a data subject, you may exercise the following rights at any time:

• Access: know what data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ('right to be forgotten'): request deletion of your data.
• Restriction of processing: restrict how we use your data in certain circumstances.
• Data portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: when processing is based on it.

To exercise any of these rights, send an email indicating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of one month. hello@atalayasec.com

If you believe the processing does not comply with GDPR, you have the right to file a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

pwndr uses exclusively technical and essential cookies for service operation: session cookies necessary to keep you logged in and interface preferences stored locally on your device.

We do not use tracking cookies, third-party analytics, or advertising cookies. No cookie consent banner is required as these are exclusively technical cookies exempt under the LSSI-CE.

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss or destruction, including encryption in transit and at rest, strict access controls and security headers in all communications.

pwndr's service is directed exclusively at persons over 18 years of age or persons acting on behalf of an organization. We do not knowingly collect data from minors. If we detect that data from a minor has been collected, we will delete it immediately.

We may update this Privacy Policy to reflect changes in the service or applicable law. We will notify material changes by email or prominent notice in the service at least 15 days before they take effect. The date of last update will always be visible at the beginning of this document.

For any questions related to this policy or the processing of your data, contact us at hello@atalayasec.com.